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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. ' 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). I 

Status 

1 )K Responsive to communication(s) filed on 1 1 September 2006 . 
2a)S This action is FINAL. 2b)D This action is non-final. 

3) Q Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 
Disposition of Claims 

4) ^ Claim(s) 1-5,11-15,21-25 and 31-61 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) Q Claim(s) is/are allowed. 

6) IEI Claim(s) 1-5,11-15.21-25 and 31-61 is/are rejected. 

7) Q Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
1 1 )0 The proposed drawing correction filed on is: a)D approved b)\Z\ disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§ 1 1 9 and 1 20 

13) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a)QAII b)D Some*c)Q None of: 

1 Certified copies of the priority documents have been received. 

2.Q Certified copies of the priority documents have been received in Application No. . 

3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 
Attachment(s) 

1 ) (3 Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) Paper No(s). . 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) □ Notice of Informal Patent Application (PTO-152) 

3) O Information Disclosure Statement(s) (PTO-1449) Paper No(s) . 6) Other: . . 
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DETAILED ACTION 



Response to Amendment 

This action is in response to the Amendment received September 11, 2006. Claims 1-5, 
11-15, 21-25, 31-61 are pending in the present application. 



Claim Rejections - 35 USC §101 
Applicant has amended claim 21 to overcome the 35 U.S.C. 101 rejection. Therefore the 
rejection is now withdrawn. 

Claim Rejections - 35 USC § 112 
Applicant has provided support for the limitation "filtering out selected records fro the 
server log" in the specification. Therefore the rejection is now withdrawn. 



Claim Rejections - 35 USC §103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 1 02 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1-5, 11-15, 21-25, 31-38, 40-44, 46-49, 51, 54, 55, 58 and 59 are rejected under 



35 U.S.C. 103(a) as being unpatentable over Haggard et al. in view of USPN 6,317,787 issued to 



Application/Control Number: 09/47 1 ,964 Page 3 

Art Unit: 2143 

Boyd et al. in further view of Network Working Group Request for Comments: 1739 submitted 
by Kessler et al. 

Regarding claims 1,11, and 21, Haggard et al. teach a method (claim 1), a system (claim 
11), and a computer program (claim 21) for real-time measurement of the performance of 
communications on a large area network between a selected server and a plurality of users at 
client machines, based upon actual user experience, including: 

accessing a server log having records of actual user access to the selected server 
(Abstract); 

aggregating records from the server log into a database (col. 7, lines 22-44); 
performing at least one statistical analysis of each time bin on each aggregate slot (col. 7, 
lines 22-44); and 

outputting the results of such statistical analysis as an indication of actual usage by users 
(Abstract; col. 2, lines 51-67 - col. 3, lines 1-6; col. 7, lines 23-44; figure 5). 

However, Haggard et al. fail to explicitly teach: accessing a server log having records 
indicative of routings through nodes of the network of actual user access to the selected server, 
wherein at least one of the nodes is part of a communication path connecting one of the client 
machines to the selected server; filtering out selected records from the server log; and 
aggregating records from the server log into a plurality of aggregate slots, each slot having at 
least one time bin which represents an interval of time, based on an aggregation method; and 
performing at least one statistical analysis separately of each time bin on each aggregate slot. 
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Kessler et al. teach accessing a server log having records indicative of routings through 
nodes of the network of actual user access to the selected server, wherein at least one of the 
nodes is part of a communication path connecting one of the client machines to the selected 
server and outputting the access-to-server result (Section 2.2 PING, and Section 2.4 
TRACEROUTE). 

Boyd et al. teach: aggregating records from the server log into a plurality of aggregate 
slots, each slot having at least one time bin which represents an interval of time, based on an 
aggregation method (figure 5; col. 1, lines 27-35; col. 2, lines 5-11; col. 3, lines 47-59; col. 8, 
lines 37-42); filtering out selected records from the server log (figures 6 and 7, no. 64); and 
performing at least one statistical analysis separately of each time bin on each aggregate slot (col. 
3, lines 47-59; col. 4, lines 10-25). 

At the time the invention was made, it would have been obvious to one of ordinary skill 
in the art to access a server log having records indicative of routings through the network of 
actual user access in order to calculate and monitor throughput of the network, and aggregate 
records into a plurality of aggregate slots having time bin and analyzing the slots separately in 
order to identify trends, statistics and other information regarding traffic data (Boyd, col. 4, lines 
18-20), therefore, facilitating in analyzing user's experience on the network. 

Regarding claims 2, 12, and 22, Kessler et al. teach accessing a server log having records 
indicative of routings through nodes of the network of actual user access to the selected server, 
wherein at least one of the nodes is part of a communication path connecting one of the client 
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machines to the selected server and outputting the access-to-server result (Section 2.2 PING, and 
Section 2.4 TRACEROUTE). 

Regarding claims 3, 13, and 23, Haggard et al. teach the method of claim 1, the system of 
claim 11, and the computer program of claim 21, farther including generating an event 
notification if a selected statistical analysis value is abnormal (figures 6A-B; col. 7, lines 61-67 - 
col. 8, lines 1-16). 

Regarding claims 4, 14, and 24, Haggard et al. teach the method of claim 1, the system of 
claim 11, and the computer program of claim 21, further including selecting the aggregation 
method from a set of aggregation methods (col. 7, lines 23-44). 

Regarding claims 5,15, and 25, Haggard et al. teach the method of claim 1, the system of 
claim 11, and the computer program of claim 21, wherein the aggregation method includes 
aggregation by log- file record column data value for each record from the server log (col. 6, lines 
61-67 -col. 7, lines 1-15). 

Regarding claim 31, Haggard fails to teach a method as in claim 1, wherein said 
statistical analysis determines time for specified user access relative to a specified interval, and 
sorts said user access according to a number of times that the application exceeds said interval. 
Boyd teaches said statistical analysis determining time for specified user access relative to a 
specified interval, and sorts said user access according to a number of times that the application 
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exceeds said interval (col. 2, lines 12-29; col. 6, lines 56-54). At the time the invention was 
made, one of ordinary skill in the art would have been motivated to combine the teaching of 
Boyd with the teaching of Haggard by enabling the statistical analysis to determine time for 
specified user access and sort said user access according to a number of times that the application 
exceeds said interval in order to identify trends, statistics and other information regarding traffic 
data (col. 4, lines 18-20), therefore, facilitating in analyzing user's experience on the network. 

Regarding claims 32, 40, and 46 Haggard fails to teach a method as in claim 1, wherein 
said server log includes a time stamp indicating when a record was formed, a client IP address, a 
time taken to complete transmission, and a size of the transmission. Boyd teaches said server log 
including a time stamp indicating when a record was formed, a client IP address, a time taken to 
complete transmission, and a size of the transmission (figure 3A). At the time the invention was 
made, one of ordinary skill in the art would have been motivated to enable said server log to 
include a time stamp indicating when a record was formed, a client IP address, a time taken to 
complete transmission, and a size of the transmission in order to identify trends, statistics and 
other information regarding traffic data (col. 4, lines 18-20), therefore, facilitating in analyzing 
user's experience on the network. 

Regarding claims 33 and 41, Haggard fails to teach a method as in claim 32, wherein said 
server log is formed by adding new data entry to the server log, and said server log is closed to 
further data entry prior to said performing. Boyd teaches said server log being formed by adding 
new data entry to the server log, and said server log is closed to further data entry prior to said 
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performing (figures 5-7). At the time the invention was made, one of ordinary skill in the art 
would have been motivated to for said server log by adding new data entry to the server log in 
order to collect new information so that it can be analyzed, and closing the server log prior to 
said performing in order prevent new information which could potentially effect statistical • 
analysis of the traffic data. 

Regarding claims 34, 42 and 47, Haggard fail to expressly teach a method as in claim 32, 
wherein said aggregating comprises determining a geographic location from the IP address, and 
aggregating IP addresses having a specified relationship with a specified geographical location. 
Boyd teaches said aggregating comprises determining a geographic location from the IP address, 
and aggregating IP addresses having a specified relationship with a specified geographical 
location (col. 3, lines 48-59; col. 4, lines 26-45; col. 5, lines 66-67 - col. 6, lines 1-10). At the 
time the invention was made, it would have been obvious to one of ordinary skill in the art to 
determine a geographic location from the IP address, and aggregating IP addresses having a 
specified relationship with a specified geographical location in order to analyze and produce 
statistical reports and summaries by way of user activity (col. 4, lines 64-67 - col. 5, lines 1-5). 

Regarding claim 35, Haggard fails to teach a method as in claim 32, further comprising 
aggregating said time bins into chronological order and determining trends among said time bins. 
Boyd teaches aggregating said time bins into chronological order and determining trends among 
send time bins (Abstract; col. 6, lines 42-55). At the time the invention was made, one of 
ordinary skill in the art would have been motivated to aggregate said time bins into chronological 
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order in order to facilitate the analyzer in producing statistics and other information regarding 
traffic data (col. 4, lines 18-20), therefore, facilitating in analyzing user's experience on the 
network. 

Regarding claim 36, Haggard fail to teach a method as in claim 32, further comprising 
using said information to compute byte density, transfer rate, and error fraction. Boyd teaches 
using said information to compute byte density, transfer rate, and error fraction (table 1, col. 5, 
lines 30-44). At the time the invention was made, one of ordinary skill in the art would have been 
motivated to compute byte density, transfer rate, and error fraction in order to identify trends, 
statistics and other information regarding traffic data (col. 4, lines 18-20), therefore, facilitating 
in analyzing user's experience on the network. 

Regarding claims 37, 43 and 48, Haggard fails to teach a method as in claim 32, wherein 
said statistical analysis is an assessment of performance related measurement against a 
geographical location of a client. Boyd teaches said statistical analysis being an assessment of 
performance related measurement against a geographical location of a client (col. 3, lines 48-59; 
col. 4, lines 26-45; col. 5, lines 66-67 - col. 6, lines 1-10). At the time the invention was made, 
one of ordinary skill in the art would have been motivated to enable said statistical analysis being 
an assessment of performance related measurement against a geographical location of a client in 
order to facilitate in analyzing and producing statistical reports and summaries by way of user 
activity. 
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Regarding claims 38, 44 and 49, Haggard fails to teach a method as in claim 32, wherein 
said statistical analysis is an assessment of a route traversed during use of the network 
application by an end user. Boyd teaches said statistical analysis being an assessment of a route 
traversed during use of the network application by an end user (col. 3, lines 48-59; col. 4, lines 
26-45; col. 5, lines 66-67 - col 6, lines 1-10). At the time the invention was made, one of 
ordinary skill in the art would have been motivated to enable said statistical analysis as being an 
assessment of a route traversed during use of the network application in order to facilitate in 
analyzing and producing statistical reports and summaries by way of user activity. t 

Regarding claims 51, 55, and 59, Haggard et al. fail to teach the method of claim 34, the 
system of claim 11, and the computer program of claim 21, the method of claim 6, the system of 
claim 16, and the computer program of claim 26, wherein determining geographical or source 
information for each record includes: 

defining a database comprising large area network address blocks having geographical or 
source information; 

comparing an address field in each record to the address blocks in the database; and 

associating with each record the geographical or source information from an address 
block matching the address field of the record. 

Boyd et al. teach: defining a database comprising large area network address blocks 
having geographical or source information (col. 4, lines 40-45). 

Although Boyd et al. do not expressly teach comparing an address field in each record to 
the address blocks in the database; and associating with each record the geographical or source 
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information from an address block matching the address field of the record, Boyd et al. teach a 
method of using analysis results collected into a log file or database for building geographic and 
other summaries (col. Lines 40-45). In order to determine geographical or source information, it 
is obvious that an address (e.g. IP address) can be somehow compared to a pre-defined address in 
a database that contains geographical or source information, once found, the addresses can be 
associated together, thus providing a geographic information. 

At the time the invention was made, it would have been obvious to one of ordinary skill 
in the art to combine the teaching of Boyd and Haggard in order to determine geographical or 
source information in order to analyze and produce statistical reports and summaries by way of 
user activity (col. 4, lines 64-67 - col. 5, lines 1-5). 

Regarding claims 54 and 58, Haggard et al. teach the system of claim 11, and the 
computer program of claim 21, further including: selecting an aggregation method to aggregate 
records (col. 7, lines 23-44). However, Haggard et al. fail to teach: 

determining geographical or source information for each record; and 
selecting the aggregation method to aggregate records based on such geographical or 
source information. 

Boyd et al. teach determining geographical or source information for each record (col. 3, 
lines 48-59; col. 4, lines 26-45; col. 5, lines 66-67 - col. 6, lines 1-10). At the time the invention 
was made, it would have been obvious to one of ordinary skill in the art to select the aggregation 
method to aggregate records based on source information in order to analyze and produce 
statistical reports and summaries by way of user activity (col. 4, lines 64-67 - col. 5, lines 1-5). 
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Claims 39, 45, 50, 53, 57 and 61 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Haggard et al. in view of Boyd, in view of Kessler et al., in further view of 
USPN 4,967,345 issued to Clarke et al. 

Regarding claims 39, 45 and 50, Haggard fails to teach a method as in claim 1, further 
comprising determining a new path based on said results of said statistical analysis. Clarke 
teaches determining a best route through a network from one node to another (Abstract; col. 2, 
lines 4-11). At the time the invention was made, one of ordinary skill in the art would have been 
motivated to combine the teaching of Haggard, Boyd, and Clerk) in order to allow the 
administrator to monitor and regulate network traffic, thus improving the network 
communications performance. 

Regarding claims 53, 57, and 61, Haggard et al. teach the method of claim 1, the system 
of claim 1 1, and the computer program of claim 21, including a statistical analysis of records 
from a server log and responding to performance data that surpasses an associated threshold 
(Abstract). 

However, Haggard et al. fail to further teach: 

determining exit routing paths from each selected server based on the records from the 
server log; 

determining a best performing exit route based on the statistical analysis of records from 
the server log; 
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biasing incoming and outgoing communications with respect to each server to use the 
determined best performing exit route. 

Clarke et al. teach determining a best route through a network from one node to another 
(Abstract; col. 2, lines 4-1 1). At the time the invention was made, it would have been obvious to 
one of ordinary skill in the art to combine the teaching of Clark et al. (best route) and the 
teaching of Haggard et al. (records from server log) in order to allow the administrator to 
monitor and regulate network traffic, thus improving the network communications performance. 

Claims 52, 56, and 60 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Haggard et al. in view of Boyd, in view of Kessler, in further view of USPN 5,946,679 issued to 
Ahuja et al. 

Regarding claims 52, 56 and 60, Haggard et al. fail to teach the method of claim 7, the 
system of claim 17, and the computer program of claim 27, wherein comparing an address field 
in each record to the address blocks in the database includes: 

defining an array of binary trees for the address blocks in the database, each address 
block within a binary tree within an array element being masked by a corresponding unique 
subnet mask value; 

masking each address field in each record by a unique subnet value corresponding to a 
selected array element; 

comparing each masked address field to an address field of the address blocks within the 
binary tree of the selected array element; 
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outputting selected fields of any matching address block; and 

otherwise, continuing the step of comparing with a next selected array element until a 
match if found or all array elements have been compared. 
Ahuja et al. teach: 

defining an array of binary trees for the address blocks in the database, each address 
block within a binary tree within an array element being masked by a corresponding unique 
subnet mask value (col. 3, lines 10-16); 

although Ahuja et al. do not explicitly teach (k) masking each address field in each record 
by a unique subnet value corresponding to a selected array element, it is well known in the art 
that all network addresses such as IP address has a subnet mask associated with it; 

comparing each masked address field to an address field of the address blocks within the 
binary tree of the selected array element (col. 3, lines 15-20); 

outputting selected fields of any matching address block (col. 3, lines 17-20); and 

otherwise, continuing the step of comparing with a next selected array element until a 
match if found or all array elements have been compared (col. 3, lines 17-20). 

At the time the invention was made, it would have been obvious to one of ordinary skill 
in the art to combine the teachings of Haggard, Boyd and Ahuja in order to facilitate 
geographical information determination, thus facilitating user's usage statistical analysis. 

Response to Arguments 
Applicant's arguments have been considered but they are not found persuasive. In 
response to Applicant's argument that Boyd neither discloses nor suggest "filtering out selected 
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records from the server log" as recited in claim 1, the PTO respectfully disagrees and submits 
that Boyd indeed does teach this limitation. As cited above, figure 6 of Boyd includes a sorter, 
which examines the hits in sequence in each of the log files and passes them to a log file 
analyzer. According to a definition provided by netlingo, a filter has substantially the same 
meaning as a sorter. The definition is reproduced below for Applicant's convenience: 

filter 

A program that examines incoming data to ensure that only information within certain parameters is 
allowed to pass through. For example, you can filter out e-mail messages based on the sender's 
information or certain subject lines. A filter is also a program that accepts a certain type of data as input, 
transforms it in some manner, and then outputs the transformed data. For example, a program that sorts 
names is a filter: It accepts names in unsorted order, sorts them, and then outputs the sorted names. 
Basically, it is a means of narrowing the scope of a report by specifying ranges or types of data to include 
or exclude. Utilities that allow you to import or export data are also sometimes called filters. 

Based on this definition, sorting is interpreted as filtering as claimed. 

Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Alina N. Boutah whose telephone number is 571-272-3908. The 
examiner can normally be reached on Monday-Friday (9:00 am - 5:00 pm). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David A. Wiley can be reached on 571-272-3923. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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